SSL: Algorithm constraints check failed

お困りですか?

アトラシアン コミュニティをご利用ください。

コミュニティに質問

 

 

プラットフォームについて: Server と Data Center のみ - この記事は、サーバーおよびデータセンター プラットフォームのアトラシアン製品にのみ適用されます。

 

問題

After copying a cacerts file from an older version of a JDK or JRE, the following appears in the daily log file:

ERROR [clusterScheduler_Worker-3]  c.a.c.d.DbCachingDirectoryPoller Error occurred while refreshing the cache for directory [ 458753 ].
com.atlassian.crowd.exception.OperationFailedException: org.springframework.ldap.CommunicationException: xxx.xxx.xxx.xxx:xxxx; nested exception is javax.naming.CommunicationException: xxx.xxx.xxx.xxx:xxxx [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Algorithm constraints check failed: MD5withRSA]
...
Caused by: org.springframework.ldap.CommunicationException: xxx.xxx.xxx.xxx:xxxx; nested exception is javax.naming.CommunicationException: xxx.xxx.xxx.xxx:xxxx [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Algorithm constraints check failed: MD5withRSA]
    at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:108) ~[spring-ldap-core-2.0.2.RELEASE.jar:2.0.2.RELEASE]
...
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Algorithm constraints check failed: MD5withRSA
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) ~[na:1.8.0_71]
...
Caused by: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Algorithm constraints check failed: MD5withRSA
    at sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:352) ~[na:1.8.0_71]
...
Caused by: java.security.cert.CertPathValidatorException: Algorithm constraints check failed: MD5withRSA
    at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:135) ~[na:1.8.0_71]

診断

環境

  • JDK/JRE has been updated, and an older cacerts file was copied into to new JDK/JRE path.

原因

During JVM releases, Oracle will update the cacerts file adding or removing security algorithms.  The older cacerts file may not contain all of the expected certificates or algorithms used in the newer JVM

ソリューション

  1. Restore the original cacerts file to the newer JDK/JRE path.
  2. Import your certificates into the new cacerts file

    $JAVA_HOME/keytool -import -alias <server_name> -keystore $JAVA_HOME/lib/security/cacerts -file CERTIFICATE_FILE_NAME 
  3. アプリケーションを再起動します。

     

 

Last modified on Mar 30, 2016

この内容はお役に立ちましたか?

はい
いいえ
この記事についてのフィードバックを送信する
Powered by Confluence and Scroll Viewport.